Pang et al. [1]} reveal that when applying the C&W attack [2]} on their trained networks some adversarial noises have clearly interpretable semantic meanings to the original images. Tsipras et al. [3]} also discover that the loss gradient of adversarially trained robust model aligns well with human perception. Interestingly, we observe similar phenomenon from our GMMC model. Fig. REF  shows some examples of adversarial noises generated from the GMMC (Gen) model under the C&W attack, where the noises are calculated as \((\mathbf {x}_{adv} - \mathbf {x}) / 2\)  to keep the pixel values in \([-0.5, 0.5]\) . We observe around 5% of adversarial noises have clearly interpretable semantic meanings to their original images. These interpretable adversarial noises indicate that GMMC (Gen) can learn robust features such that the adversarial examples found by the C&W attack have to weaken the features of the original images as a whole, rather than generating salt-and-pepper like perturbations as for models of lower robustness.
